# FlyLong: public balance-forging functions drain WBNB pair

FlyLong token's public tokenMarketing/tradingTake let attacker forge the pair's FlyLong balance during a Pancake swap callback, draining 1.73 BNB of WBNB.

- Payout: Real-world hack
- Severity: high
- Program: FlyLong
- Credited: DeFiHackLabs
- Disclosed: 2025-04-29
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-04/flylong_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250429-flylong
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan

**Target:** BEP-20 token contract with PancakeSwap pair
**Root cause:** FlyLong exposes public balance-writing functions (tokenMarketing, tradingTake) callable by any low-BNB-balance caller, letting an attacker arbitrarily inflate the pair's FlyLong balance to satisfy the K invariant.
**Steps:**
1. Borrow ~99.99% of WBNB from FlyLong/WBNB pair via `swap(0, amountOut, this, data)`
2. In `pancakeCall`, call `flyLong.tokenMarketing(address(this))` to trigger balance manipulation
3. Read pair's FlyLong balance and call `flyLong.tradingTake(FLYLONG_WBNB_PAIR, pairTokenBalance * 100_000)` to forge the pair's FlyLong balance
4. Return WBNB to pair satisfying K check, withdraw WBNB to BNB, transfer profit
**Exploitation:** Flash-swap nearly all WBNB out of the FlyLong/WBNB pair, then in the callback abuse public tokenMarketing/tradingTake to forge the pair's FlyLong token balance so the K invariant passes despite WBNB being removed; repay nominal amount and keep the drained WBNB.
**Insight:** Token contracts with public 'marketing/take' style functions that write balances can be abused inside AMM swap callbacks to forge pair reserves and bypass the K check; audit any token exposing balance-mutating functions callable by arbitrary addresses.